Gentlemen ransomware is using layered defence evasion and recovery disruption to increase the impact of attacks. New research published on 21 October 2026 details how affiliates disable Microsoft Defender, terminate security tools, delete recovery data and encrypt systems.
The ransomware as a service operation also steals data before encryption, creating pressure through both operational disruption and the threat of publication. Although the operators claim more than 800 victims, that figure has not been independently verified.
Gentlemen ransomware attack methods explained
Acronis Threat Research Unit published an in-depth profile of the operation on 21 October 2026. Its findings expand the known picture of an active, cross-platform ransomware group whose affiliates prepare environments carefully before launching encryption.
The Gentlemen was first observed operating as a closed ransomware group in mid 2025. It transitioned to a ransomware as a service model in September 2025, allowing affiliates to conduct intrusions using the operation’s tools and infrastructure.
The latest research describes a sequence designed to reduce the chance that security software will interrupt the attack or that an organisation will recover quickly. Observed actions include:
- Disabling Microsoft Defender real-time protection through PowerShell.
- Adding broad Defender exclusions that prevent selected paths from being scanned.
- Using vulnerable third-party drivers to terminate endpoint security processes.
- Stopping backup-related services and deleting Windows Volume Shadow Copies.
- Clearing Windows Security, System and Application event logs.
- Running the encryptor with SYSTEM privileges through a scheduled task.
- Stealing data before encryption as part of a double extortion strategy.
These are operational attack techniques rather than exploitation of a newly disclosed CVE. There is therefore no public proof of concept in the conventional vulnerability sense. The toolset is already being used in the wild by multiple affiliates across regions and sectors.
Microsoft Defender tampering through PowerShell
On compromised Windows systems, affiliates have used PowerShell commands to turn off Defender real-time monitoring. They can also configure exclusions covering broad directories, reducing the likelihood that malicious files or activity in those locations will be inspected.
Huntress publicly documented this Defender tampering during two incident investigations on 21 May 2026. The responders also observed the attackers clearing Windows event logs, showing that security impairment and evidence removal were incorporated into real intrusions rather than being merely theoretical capabilities.
Changing these settings generally requires elevated permissions. Their successful use can therefore indicate that an attacker has already gained significant control, whether through compromised credentials, remote access or another earlier stage of intrusion.
Vulnerable drivers used to kill EDR tools
The Acronis profile adds detail about a dedicated endpoint detection and response killer used by Gentlemen ransomware affiliates. The toolkit applies a bring-your-own-vulnerable-driver technique, commonly called BYOVD, in which an attacker loads a legitimate but vulnerable signed driver and abuses its privileged access.
Acronis observed tooling involving the Safetica ProcessMonitor driver and Lenovo BootRepair.sys. Once loaded, the drivers can provide a route to terminate protected security processes that ordinary malware might be unable to stop.
This allows an affiliate to attack endpoint protection from within the Windows kernel’s trusted environment. It also means defenders should not limit monitoring to unknown drivers. Unexpected installation or loading of legitimate drivers with known security weaknesses may be equally significant.
How Gentlemen ransomware blocks Windows recovery
Microsoft Threat Intelligence documented the operation’s pre-encryption behaviour on 28 May 2026. This included deleting all available Volume Shadow Copies, which removes snapshots used by the Windows Previous Versions feature and by some local recovery processes.
Shadow copy deletion is a well-established recovery inhibition technique, mapped by MITRE ATT&CK as T1490. For Gentlemen ransomware, it forms part of a wider preparation phase that can also include disrupting backup-related services before files are encrypted.
The malware can then create a one-time scheduled task, often named gentlemen_system, to launch the encryptor under the SYSTEM account. SYSTEM privileges provide extensive access across a Windows host, helping the ransomware reach files that a normal user account could not modify.
Attackers also clear the Security, System and Application logs. This does not guarantee that all evidence disappears, particularly where logs are forwarded to an external platform, but it can remove important local records needed to reconstruct execution, account activity and service changes.
Encryption and cross-platform targeting
The operation is not restricted to Windows. Researchers report targeting of Windows, Linux, NAS and BSD systems, with activity in the wider ecosystem also involving ESXi environments. No specific affected product versions have been identified because this is an adversary-led intrusion campaign, not a version-bounded software flaw.
The primary encryptor is written in Go and obfuscated using Garble, supporting deployment across different operating systems. Microsoft documented per-file ephemeral Curve25519 keys combined with the XChaCha20 stream cipher. Encryption metadata is appended to affected files so the corresponding decryption process can identify the information required for recovery.
Using a per-file key design means that recovering one key would not automatically unlock every encrypted file. In practice, restoration from clean backups remains the safer recovery route, provided those backups were isolated from the compromised environment.
Gentlemen ransomware timeline and victim claims
The public reporting developed rapidly during 2026. Huntress described Defender tampering and event log clearing on 21 May. Microsoft followed on 28 May with analysis covering pre-encryption activity, shadow copy deletion and self-propagation, while Kaspersky published further technical research on 29 June.
Acronis added the latest EDR-killer details on 21 October 2026. This development builds on CyPro’s earlier bulletin on Gentlemen ransomware and BYOVD attacks.
Acronis states that the group has claimed more than 800 victims. This should be treated as an operator claim, not a confirmed infection count. Other trackers have reported lower totals based on leak site entries, but those methodologies may exclude unlisted victims or organisations that negotiated privately.
Microsoft tracks the operators as Storm-2697 and reports global victimology. Multiple affiliates remain active, so techniques, entry routes and tooling may differ between incidents even when the same ransomware payload is used.
Why this campaign matters to UK organisations
Many UK organisations rely on Microsoft Defender, local recovery features and network-connected backups. Gentlemen ransomware directly targets each of those layers before encryption begins.
Double extortion also means successful restoration does not resolve every consequence. Data stolen before encryption may still expose an organisation to regulatory, contractual and reputational risks.
Actions to take against Gentlemen ransomware
Defenders should prioritise controls and monitoring tied to the behaviours reported in this campaign:
- Prevent unauthorised changes to Defender settings and alert on real-time protection being disabled or broad exclusions being created.
- Monitor for shadow copy deletion, backup service interruption and unexpected use of native recovery administration tools.
- Alert on creation of a gentlemen_system scheduled task and investigate unfamiliar tasks running programs as SYSTEM.
- Detect unexpected loading of Safetica ProcessMonitor, Lenovo BootRepair.sys and other vulnerable drivers.
- Forward Windows event logs to protected external storage so local clearing does not destroy the only evidence.
- Keep immutable or offline backups separate from production credentials, then test restoration procedures.
Organisations should also use Microsoft’s published hunting guidance and translate the Acronis driver findings into endpoint detection rules. Monitoring the preparation phase offers the best opportunity to stop Gentlemen ransomware before encryption and data loss cause wider disruption.
Originally reported by cybersecuritynews.com.
